Government Data Rules Eliminate Hope of Privacy for US Air Travelers

Most airlines outsource their domestic reservation databases, known as Passenger Name Records (PNRs), to organizations with clever names like Sabre, Amadeus and Worldspan.

"With the cost of storage dropping, retention times have been increasing, but they've always been at least three to five years," said Edward Hasbrouck, the travel guru at Airtreks.com, an Internet travel agency. "PNRs are kept in live storage until the completion of travel, after which they are moved to permanent archival storage."

Since 9-11, the government has been closely eying that domestic travel data through the jurisdiction of the U.S. Patriot Act and other measures. As a result, travelers in the United States "shouldn't have confidence in the privacy of their reservations," said Hasbrouck.

Privacy Reservations

Experts believe that, unless the U.S. Congress passes an act to ensure privacy of travelers -- unlikely, due to national security concerns -- collection of data about travelers will intensify, giving government users and some commercial entities the ability to track your travels and expected comings and goings.

According to market analysis from IT research consultancy Frost & Sullivan , U.S. government travel security spending was US$7.49 billion in 2002.

But that figure is expected to grow to $16 billion by 2009, as the Transportation Security Administration (TSA) of the Department of Homeland Security (DHS) implements the proposed Computer Assisted Passenger Pre-Screening System (CAPPS II).

This system will be used by ticketing agents at airports to scan your travel history as you prepare to board a plane, determining whether you are a security risk or a benign passenger -- that is, whether you should be green-lighted or red-carded.

Although terrorism is a global threat, this kind of record-keeping is only emerging in the United States.

European Objections

"In October, the European Parliament formally laid out its objections to the U.S. requirement to submit airline passenger data for all transatlantic flights," said Jack Hermansen, CEO of Language Analysis Systems, a software developer located in suburban Washington, D.C. "This resolution had some rather harsh criticism of our ability to guarantee the same level of data protection that the European Union feels it is bound to provide its citizens."

There is some concern that the invasions of privacy may go even further. A pilot program, U.S. Visitor Immigrant Status Indication Technology System (US VISIT), is tracking the biometric data, fingerprints and facial images of certain foreigners who come into the United States.

But technology experts expect that in coming years, the software and hardware developed for this program likely will become standard for domestic travel as well. Customers will have 3D images made of their heads before they travel, with technology that has already been developed.

"You can actually see around the sides of a subject's head, on top, under the chin," said Grant Evans, CEO of A4Vision, a biometric technology developer. "The facial characteristics -- hard tissue -- are measured submicron. Accuracy is consistent."

Evans reckons that proliferation of this kind of technology eventually will lead to increased privacy for passengers.

"Database privacy becomes a nonissue when the identification data is stored locally on a card or document carried by its owner, while databases store only information that can complete a check to corroborate that the holder and the identity on the card or document match," said Evans.

Marketers Tout Benefits

Marketers of travel-related benefits programs -- such as frequent flier miles -- also tout technology as protecting the privacy of customers.

"Points.com members treat frequent flier miles and loyalty points just like currency," said Darlene Higbee Clarkin, CTO of Points International, a service that lets users exchange miles for other goods and services.

"They're exchanging thousands of miles and points at any given time between loyalty programs," Clarkin said. "We've implemented the same security measures you would expect from a bank account. Our customers can be confident that sensitive data is being protected by encryption technologies."

She noted that her site, for example, was built by IBM (NYSE: IBM) using technology from BEA (Nasdaq: BEAS) , Weblogic and Oracle (Nasdaq: ORCL) , and is hosted by Digex (Nasdaq: DIGX) .

But skeptics are doubtful.

Skeptics Speak Out

"There's an 'if you build it they will come' aspect to data collection and maintenance in such systems," said Hasbrouck.

"Once the data exists, even if technology restricts access to authorized users, technology can't determine who should be authorized," he said. "Decisions about authorization for access are policy choices and can change long after the data is collected. Unless the records are destroyed, data can be used for purposes that weren't anticipated or authorized when it was collected."

Hasbrouck observes that as long as the data is kept, it can be requested by the DHS or TSA, regardless of whether the government maintains its own "mirror" of these data archives.

"The distinction between data retained by the government and by the private sector is largely meaningless in light of the Patriot Act provisions for the government to demand privately held data, in secrecy, without the need of a court order," said Hasbrouck.